Skip to content
OpenAdvisories
Medium ELSA-2023-7050 2 CVEs

Moderate: python38:3.8 and python38-devel:3.8 security update (Oracle Linux 8)

Published Nov 18, 2023 · Updated Nov 18, 2023

Summary

babel
Cython
mod_wsgi
[4.6.8-5]
- Remove rpath
Resolves: rhbz#2213836

[4.6.8-4]
- Core dumped upon file upload >= 1GB
Resolves: rhbz#2125171

[4.6.8-3]
- Exclude unsupported i686 arch (rhbz#1779142)

[4.6.8-2]
- Adjusted for Python 3.8 module in RHEL 8

[4.6.8-1]
- update to 4.6.8 (#1721376)

[4.6.6-6]
- try again to drop Python 2

[4.6.6-5]
- drop python2 build

[4.6.6-4]
- Rebuilt for Python 3.8.0rc1 (#1748018)

[4.6.6-3]
- Rebuilt for Python 3.8

[4.6.6-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild

[4.6.6-1]
- update to 4.6.6 (rhbz#1718151)

[4.6.5-1]
- update to 4.6.5

[4.6.4-4]
- only build docs with Python 3
- fix build on Fedora>30 and RHEL 7

[4.6.4-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild

[4.6.4-2]
- Run Python 3 build in a subdir, so module isn't linked against both
libpython 2 and libpython 3 (rhbz#1609491)

[4.6.4-1]
- update to 4.6.4 (rhbz#1560329)

[4.6.2-5]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild

[4.6.2-4]
- Rebuilt for Python 3.7

[4.6.2-3]
- use sphinx-build-3 if python2 support is disabled

[4.6.2-2]
- Update conditionals.
- Make preperations for non-python2 builds

[4.6.2-1]
- update to 4.6.2 (rhbz#1514768)
- add gcc BR

[4.5.20-4]
- restrict module DSO symbol exports

[4.5.20-3]
- Update Python 2 dependency declarations to new packaging standards
(See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)

[4.5.20-2]
- Python 2 binary package renamed to python2-mod_wsgi
See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3

[4.5.20-1]
- update to 4.5.20

[4.5.15-5]
- include mod_wsgi Python package and mod_wsgi-express script

[4.5.15-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild

[4.5.15-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[4.5.15-2]
- Rebuild due to bug in RPM (RHBZ #1468476)

[4.5.15-1]
- update to 4.5.15 (#1431893)

[4.5.13-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

[4.5.13-1]
- Update to 4.5.13

[4.5.9-2]
- Rebuild for Python 3.6

[4.5.9-1]
- upgrade to 4.5.9 (rhbz#1180445)

[4.4.8-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild

[4.4.8-3]
- Rebuilt for https://fedoraproject.org/wiki/Changes/python3.5

[4.4.8-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild

[4.4.8-1]
- Upstream to 4.4.8.
- This version includes the fix for the segfault described in RHBZ#1178851.

[4.4.3-1]
- update to new upstream version 4.4.3 (#1176914)

[4.4.1-1]
- update to new upstream version 4.4.1 (#1170994)

[4.3.2-1]
- update to new upstream version 4.3.2 (#1104526)

[3.5-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild

[3.5-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild

[3.5-1]
- Update to 3.5 to fix CVE-2014-0240 (#1101863)
- Remove all of the patches, which have been applied upstream
- Update source URL for new the GitHub upstream

[3.4-14]
- rebuild for Python 3.4

[3.4.13]
- do not use conflicts between mod_wsgi packages (rhbz#1087943)

[3.4-12]
- fix _httpd_mmn expansion in absence of httpd-devel

[3.4-11]
- added python3 subpackage (thanks to Jakub Dornak), rhbz#1035876

[3.4-10]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild

[3.4-9]
- modernize spec file (thanks to rcollet)

[3.4-8]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild

[3.4-7]
- compile with -fno-strict-aliasing to workaround Python
bug http://www.python.org/dev/peps/pep-3123/

[3.4-6]
- use _httpd_moddir macro

[3.4-5]
- spec file cleanups

[3.4-4]
- enable PR_SET_DUMPABLE in daemon process to enable core dumps

[3.4-3]
- use a NULL c->sbh pointer with httpd 2.4 (possible fix for #867276)
- add logging for unexpected daemon process loss

[3.4-2]
- also use RPM_LD_FLAGS for build bz. #867137

[3.4-1]
- update to upstream release 3.4

[3.3-7]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild

[3.3-6]
- add possible fix for daemon mode crash (#831701)

[3.3-5]
- move wsgi.conf to conf.modules.d

[3.3-4]
- rebuild for httpd 2.4

[3.3-3]
- prepare for httpd 2.4.x

[3.3-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild

[3.3-1]
- update to 3.3

[3.2-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild

[3.2-2]
- Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild

[3.2-1]
- update to 3.2

[3.1-2]
- removed conflicts as it violates fedora packaging policy

[3.1-1]
- update to 3.1
- add explicit enable-shared
- add conflicts mod_python < 3.3.1

[2.5-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild

[2.5-1]
- Update to 2.5

[2.3-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

[2.3-2]
- Rebuild for Python 2.6

[2.3-1]
- Update to 2.3

[2.1-2]
- Remove requires on httpd-devel

[2.1-1]
- Update to 2.1

[1.3-4]
- Build against the shared python lib.

[1.3-3]
- Autorebuild for GCC 4.3

[1.3-2]
- Require httpd

[1.3-1]
- Update to 1.3

[1.0-1]
- Initial packaging for Fedora

numpy
[1.17.3-7]
- Skip TestCond.test_nan
- Resolves: rhbz#2217862

python38
[3.8.17-2]
- Fix symlink handling in the fix for CVE-2023-24329
Resolves: rhbz#263261

[3.8.17-1]
- Update to 3.8.17
- Security fix for CVE-2023-24329
- Add filters for tarfile extraction (CVE-2007-4559, PEP-706)
Resolves: rhbz#2173917, rhbz#263261

[3.8.16-2]
- Strip the LTO bytecode from python.o
Resolves: rhbz#2213526

python3x-pip
python3x-setuptools
python3x-six
[1.12.0-10]
- Rebuild from a new component name

[1.12.0-9]
- Exclude unsupported i686 arch

[1.12.0-8]
- Adjusted for Python 3.8 module in RHEL 8

[1.12.0-7]
- Rebuilt for Python 3.8.0rc1 (#1748018)

[1.12.0-6]
- Reduce Python 2 build dependencies

[1.12.0-5]
- Rebuilt for Python 3.8

[1.12.0-4]
- Bootstrap for Python 3.8

[1.12.0-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild

[1.12.0-1]
- Update to 1.12.0

[1.11.0-7]
- Rebuilt f

Fixed packages 51

ReleasePackageFixed in
Oracle Linux · 8 python38 0:3.8.17-2.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-asn1crypto 0:1.2.0-3.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-atomicwrites 0:1.3.0-8.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-attrs 0:19.3.0-3.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-babel 0:2.7.0-11.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-cffi 0:1.13.2-3.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-chardet 0:3.0.4-19.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-cryptography 0:2.8-3.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-Cython 0:0.29.14-4.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-debug 0:3.8.17-2.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-devel 0:3.8.17-2.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-idle 0:3.8.17-2.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-idna 0:2.8-6.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-jinja2 0:2.11.3-1.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-libs 0:3.8.17-2.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-lxml 0:4.4.1-7.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-markupsafe 0:1.1.1-6.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-mod_wsgi 0:4.6.8-5.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-more-itertools 0:7.2.0-5.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-numpy 0:1.17.3-7.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-numpy-doc 0:1.17.3-7.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-numpy-f2py 0:1.17.3-7.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-packaging 0:19.2-3.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-pip 0:19.3.1-7.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-pip-wheel 0:19.3.1-7.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-pluggy 0:0.13.0-3.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-ply 0:3.11-10.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-psutil 0:5.6.4-4.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-psycopg2 0:2.8.4-4.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-psycopg2-doc 0:2.8.4-4.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-psycopg2-tests 0:2.8.4-4.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-py 0:1.8.0-8.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-pycparser 0:2.19-3.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-PyMySQL 0:0.10.1-1.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-pyparsing 0:2.4.5-3.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-pysocks 0:1.7.1-4.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-pytest 0:4.6.6-3.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-pytz 0:2019.3-4.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-pyyaml 0:5.4.1-1.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-requests 0:2.22.0-10.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-rpm-macros 0:3.8.17-2.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-scipy 0:1.3.1-5.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-setuptools 0:41.6.0-5.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-setuptools-wheel 0:41.6.0-5.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-six 0:1.12.0-10.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-test 0:3.8.17-2.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-tkinter 0:3.8.17-2.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-urllib3 0:1.25.7-5.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-wcwidth 0:0.1.7-16.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-wheel 0:0.33.6-6.module+el8.9.0+90017+9913aa0c
Oracle Linux · 8 python38-wheel-wheel 0:0.33.6-6.module+el8.9.0+90017+9913aa0c

Vulnerabilities 2

  • Critical 9.8
    CVE-2007-4559 Public exploit EPSS 27%

    Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allow…

  • Medium 6.1
    CVE-2023-32681 Public exploit

    Unintended leak of Proxy-Authorization header in requests

    Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header…